# FuzzerGym: A Competitive Framework for Fuzzing and Learning

arXiv: https://arxiv.org/abs/1807.07490 · HTML: https://mlsanity.com/paper/1807.07490/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Jul 2018.

## Built on by (most cited first, 4 of 4)

- [Search-Based Testing of Reinforcement Learning](https://mlsanity.com/paper/2205.04887/) (2022)
- [BertRLFuzzer: A BERT and Reinforcement Learning Based Fuzzer](https://mlsanity.com/paper/2305.12534/) (2023)
- [A Comparison of Reinforcement Learning Frameworks for Software Testing Tasks](https://mlsanity.com/paper/2208.12136/) (2022)
- [Revisiting Neural Program Smoothing for Fuzzing](https://mlsanity.com/paper/2309.16618/) (2023)

## Abstract (arXiv)

Fuzzing is a commonly used technique designed to test software by automatically crafting program inputs. Currently, the most successful fuzzing algorithms emphasize simple, low-overhead strategies with the ability to efficiently monitor program state during execution. Through compile-time instrumentation, these approaches have access to numerous aspects of program state including coverage, data flow, and heterogeneous fault detection and classification. However, existing approaches utilize blind random mutation strategies when generating test inputs. We present a different approach that uses this state information to optimize mutation operators using reinforcement learning (RL). By integrating OpenAI Gym with libFuzzer we are able to simultaneously leverage advancements in reinforcement learning as well as fuzzing to achieve deeper coverage across several varied benchmarks. Our technique connects the rich, efficient program monitors provided by LLVM Santizers with a deep neural net to learn mutation selection strategies directly from the input data. The cross-language, asynchronous architecture we developed enables us to apply any OpenAI Gym compatible deep reinforcement learning algorithm to any fuzzing problem with minimal slowdown.